Is this due to the php vulnerability from a few weeks ago? Guessing they were on some php-based cms, and their staff never got around to fixing it in time.
Ransomware infections frequently start with a phished user, not a popped web app.
Ransomware infections frequently start with a phished user, not a popped web app.